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Why GAO Did This Study 

As part of a multilayered effort to 
strengthen port security, the 
Maritime Transportation Security 
Act (MTSA) of 2002 calls for the 
Department of Homeland Security 
(DHS) to issue a worker 
identification card that uses 
biological metrics, such as 
fingerprints, to control access to 
secure areas of ports or ships. 
Charged with the responsibility for 
developing this card, the 
Transportation Security 
Administration (TSA), within DHS, 
initially planned to issue a 
Transportation Worker 
Identification Credential in August 
2004 to about 6 million maritime 
workers. 

GAO assessed what factors limited 
TSA's ability to meet its August 
2004 target date for issuing cards 
and what challenges remain for 
TSA to implement the card. 



What GAO Recommends 



To help ensure that TSA meets the 
challenges it is facing in developing 
and operating its maritime worker 
identification card program, we are 
recommending that the Secretary 
of Homeland Security direct the 
TSA Administrator to employ 
industry best practices for project 
planning and management, by 
developing a comprehensive 
project plan for managing the 
remaining life of the project and 
other specific, detailed plans for 
risk mitigation and cost-benefit and 
alternatives analyses. DHS and 
TSA generally concurred with 
GAO's recommendations. 

www.gao.gov/cgi-bin/getrpt7GAO-05-106. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Margaret 
Wrightson at (41 5) 904-2000 or 
wrightsonm@gao.gov. 



What GAO Found 

Three main factors, all of which resulted in delays for testing a prototype of 
the maritime worker identification card system, caused the agency to miss 
its initial August 2004 target date for issuing the cards: (1) officials had 
difficulty obtaining timely approval to proceed with the prototype test from 
DHS, (2) extra time was required to identify data to be collected for a cost- 
benefit analysis, and (3) additional work to assess card technologies was 
required. DHS has not determined when it may begin issuing cards. 

In the future, TSA will face difficult challenges as it moves forward with 
developing and operating the card program, for example, developing 
regulations that identify eligibility requirements for the card. An additional 
challenge — and one that holds potential to adversely affect the entire 
program — is that TSA does not yet have a comprehensive plan in place for 
managing the project. Failure to develop such a plan places the card 
program at higher risk of cost overruns, missed deadlines, and 
underperformance. Following established, industry best practices for project 
planning and management could help TSA address these challenges. Best 
practices suggest managers develop a comprehensive project plan and other, 
detailed component plans. However, while TSA has initiated some project 
planning, the agency lacks an approved comprehensive project plan to 
govern the life of the project and has not yet developed other, detailed 
component plans for risk mitigation or the cost-benefit and alternatives 
analyses. 
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United States Government Accountability Office 
Washington, DC 20548 



December 10, 2004 

The Honorable John McCain 
Chairman 

The Honorable Ernest F. Hollings, Jr. 
Ranking Minority Member 

Committee on Commerce, Science, and Transportation 
United States Senate 

Protecting waterfronts and ports from terrorist threats has taken on 
special urgency in the post-September 11, 2001, world. Hubs of economic 
activity involving millions of workers and often tied to the nation's land 
transportation network, U.S. seaports are particularly vulnerable to 
terrorism and particularly challenging to protect. To strengthen port 
security, Congress enacted the Maritime Transportation Security Act 
(MTSA) of 2002, 1 which establishes a multilayered defense strategy to 
strengthen port security. As part of this effort, MTSA calls for the 
Secretary of the Department of Homeland Security (DHS) to issue a 
maritime worker identification card that uses biometrics, such as 
fingerprints, to control access to secure areas of ports or ships. The 
Transportation Security Administration (TSA) within DHS, which was 
charged with developing this identification card, initially planned to issue 
the cards in August 2004 to about 6 million maritime workers; however, 
TSA missed that target date. 

After we testified in September of 2003 on the challenges DHS faces in 
implementing MTSA, 2 you asked us to follow up on certain issues. This 
report addresses (1) what factors caused TSA to miss its August 2004 
target date for issuing the identification cards and (2) what challenges 
remain as TSA attempts to issue the identification cards. 

To respond to your concerns, we interviewed DHS and TSA officials and 
collected and analyzed documents and other information from them. We 
also interviewed port and port facility managers and labor union officials. 
We visited ports and facilities involved in testing TSA's prototype 



'Pub. L. No. 107-295, 116 Stat. 2064 (2002). 

2 See GAO, Maritime Security: Progress Made in Implementing Maritime Transportation 
Security Act, but Concerns Remain, GAO-03-1155T (Washington, D.C.: Sept. 9, 2003). 
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identification card system and representing different types of facilities on 
both east and west coasts. 3 Since the maritime worker identification card 
is a major information technology system, we also reviewed Office of 
Management and Budget (OMB) regulations, GAO and DHS guidance for 
documenting and reviewing information technology investments, and 
established industry best practices for information technology project 
management and planning. We asked TSA officials what steps they took to 
ensure the reliability of the data on which they based their life cycle cost 
estimates. TSA officials said they used a range of documents and sources 
to ensure data reliability, including information and lessons learned from 
other federal credentialing programs. 4 Officials also used estimates from 
government and industry sources, published component cost quotes, and 
costs extrapolated from current government programs. We conducted our 
work from October 2003 through October 2004 in accordance with 
generally accepted government auditing standards. 



RGSllltS in Brief Three main factors, all of which resulted in delays for testing the prototype 

card system, caused the agency to miss its initial August 2004 target date 
for issuing maritime worker identification cards. 5 First, TSA officials said 
that although the agency received permission from TSA and DHS 
information technology officials to test a card system prototype, it was 
difficult to obtain a response from DHS policy officials, which contributed 
to delays. Senior DHS policy officials said that, while they were 
consistently briefed throughout the development of the worker 
identification card, they did not provide a formal response regarding the 
prototype test to program officials because other important security and 
statutory requirements, including the creation and consolidation of DHS 



3 Of the facilities testing TSA's prototype, we visited ports and facilities in the Delaware 
River Region, including Wilmington Port Authority, the Philadelphia Maritime Exchange, 
and the South Jersey Port. We also visited ports and facilities on the west coast, including 
those in the Port of Seattle, Port of Los Angeles, and Port of Long Beach as well as ports 
and facilities in Florida, including Port Everglades and the Port of Jacksonville, and Florida 
state agencies responsible for the state's biometric identification card program for 
maritime workers. 

4 These other credentialing programs included OMB's Interagency Advisory Board, various 
federal working groups, General Services Administration (GSA) Smart Access Common ID 
(referred to commonly as the Smart Card Schedule) Contract and its Smart Card Center of 
Excellence Smart Card, Biometric and Security industry events, and industry 
representatives. 

5 Testing a biometric card system prototype is scheduled to begin in fall 2004, and the final 
report on the prototype is to be completed by May 2005. 
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and the planning and execution of measures to close security gaps in the 
international aviation arena, created competition for executive level 
attention and agency resources. Second, DHS officials also directed TSA, 
as part of the prototype test, to conduct a cost-benefit analysis and 
evaluate the feasibility of various program alternatives for issuing a card. 
Working with DHS and OMB officials to identify additional information 
needed for the cost-benefit and alternative analyses required time, further 
delaying the prototype test. TSA officials said that because of the urgency 
to establish an identification card program after the terrorist attacks of 
September 11, 2001, these analyses were not completely documented as 
required by OMB regulations and DHS guidance. Third, TSA officials said 
that in response to direction from congressional oversight committees, 
they conducted additional tests of various card technologies, comparing 
their performance at different seaports. This technical assessment 
required more time to complete than anticipated, delaying the prototype 
test. This type of assessment is typical of good program management and 
planning and, while it may have delayed the original schedule, the purpose 
of such assessments is to prevent delays in the future. Because of the 
delays in the program, some port facilities have made temporary security 
improvements, while others, recognizing an immediate need to enhance 
access control systems, are proceeding with plans for local or regional 
identification cards. 

TSA officials indicated that in the near future, as they move forward with 
developing and operating a maritime worker identification card program, 
they face a number of challenges, including resolving issues with external 
stakeholders and completing regulations. An additional challenge that 
officials did not specifically identify — but one that holds potential to 
adversely affect the entire program — is that TSA is attempting to develop 
this program without following industry-established best practices for 
project planning and management. Such practices call for a 
comprehensive plan that identifies work to be completed, milestones for 
completing this work, and project budgets for the remaining life of the 
project. TSA, however, does not yet have an approved, comprehensive 
plan in place for the next phases of the project — testing the prototype card 
system and issuing cards. TSA officials said that in the near term they 
intend to complete a plan to guide the test of the prototype card system, 
but that until policy decisions are made, for example, selecting the most 
feasible program for issuing the card, they cannot create a plan for the 
remaining life of the project. Moving ahead without such a plan holds 
significant potential to adversely affect the card program, putting it at 
higher risk of cost overruns, missed deadlines, and underperformance. 
Best practices for such projects also suggest that project managers 
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prepare other more detailed plans — such as plans for mitigating risks — to 
support the comprehensive plan. However, TSA has not yet prepared some 
of these more specific detailed component plans. For instance, TSA lacks 
a risk mitigation plan to help manage known risks, such as a potential 
decline in external stakeholders' support of the program, which may 
complicate TSA's ability to issue the card. Further, TSA officials said they 
do not have a plan in place to guide the required cost-benefit and 
alternatives analyses, which are to determine the feasibility of various 
approaches to issue the cards. 

To help ensure that TSA meets the challenges it is facing in developing and 
operating its maritime worker identification card program, we are 
recommending that the Secretary of Homeland Security direct the TSA 
Administrator to employ industry best practices for project planning and 
management, including developing a comprehensive project plan for 
managing the remaining life of the project and completing specific, 
detailed plans that support the comprehensive project plan, including 
plans for risk mitigation and cost-benefit and alternatives analyses. DHS 
and TSA reviewed our report and generally concurred with our 
recommendations. 



Bctck^rOlind ^ ^ ar ^ °^ a mu ^^ a y ere ^ defense strategy, MTSA required vessels and port 

" facilities to have security plans in place by July 1, 2004, including 

provisions establishing and controlling access to secure areas of vessels 
and ports. Given that ports are not only centers for passenger traffic and 
import and export of cargo, but also sites for oil refineries, power plants, 
factories, and other facilities important to the nation's economy, securing 
sensitive sites of ports and vessels against access from unauthorized 
persons is critical. But because ports are often large and diverse places, 
controlling access can be difficult. To facilitate access control, MTSA 
required the DHS Secretary to issue a biometric identification card to 
individuals who required unescorted access to secure areas of port 
facilities or to vessels. These secure areas are to be defined by port 
facilities and vessels in designated security plans they were to submit to 
the United States Coast Guard (USCG) in July 2004. 

About 1 year before the passage of MTSA in 2002, work on a biometric 
identification card began at the Department of Transportation (DOT), 
partly in response to provisions in the Aviation and Transportation 
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Security Act 6 and the USA PATRIOT Act 7 that relate to access control in 
transportation sectors. TSA — then a part of DOT — began to develop a 
transportation worker identification credential (TWIC) 8 as an identity 
authentication tool that would ensure individuals with such an 
identification card had undergone an assessment verifying that they do not 
pose a terrorism security risk. The credential was designed by TSA to be a 
universally recognized identification card accepted across all modes of the 
national transportation system, including airports, seaports, and railroad 
terminals, for transportation workers requiring unescorted physical access 
to secure areas in this system. The credential is also to be used to help 
secure access to computers, networks, and applications. 

As shown in figure 1, ports or facilities could use an identification 
credential that stored a biometric, such as a fingerprint, to verify a 
worker's identity and, through a comparison with data in a local facility 
database, determine the worker's authority to enter a secure area. 



Tub. L. No. 107-71, 115 Stat. 597 (2001). 

7 The 2001 law titled Uniting and Strengthening America by Providing Appropriate Tools 
Required to Intercept and Obstruct Terrorism Act of 2001 is also known as the USA 
PATRIOT Act. Pub. L. No. 107-56, 115 Stat. 272 (2001). 

8 While TSA has not selected TWIC as the most appropriate approach to issue the biometric 
identification card required by MTSA, TSA program officials use the term TWIC to describe 
their maritime card program. 
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Figure 1 : How a Biometric Card Could Be Used to Control Access 



TSA's identification 
management system 




Data shared on 

• Valid cards 

• "Hotlisted" cards 3 

• Workers denied access 
by local ports 





Source: GAO analysis of TSA and state of Florida data. 

a Cards that are no longer valid due to new threat information or because they are lost, 
stolen, or damaged. 



During early planning stages in 2003 and while still a part of DOT, TSA 
decided that the most feasible approach to issue a worker identification 
card would be a cost-sharing partnership between the federal government 
and local entities, with the federal government providing the biometric 
card and a database to confirm a worker's identity and local entities 
providing the equipment to read the identity credential and to control 
access to a port's secure areas. In 2003, TSA projected that it would test a 
prototype of such a card system within the year and issue the first of the 
cards in August 2004. 



In March 2003, as part of a governmentwide reorganization, TSA became a 
part of DHS and was charged with implementing MTSA's requirement for a 
maritime worker identification card. TSA decided to use the prototype 
card system to issue the maritime identification card required under 
MTSA. At that time, TSA was preparing to test a prototype card system; 
later, DHS policy officials directed the agency to explore additional 
options for issuing the identification card required by MTSA. As a result, in 
addition to testing its prototype card system, TSA is exploring the cost- 
effectiveness of two other program alternatives: (1) a federal approach: a 
program wholly designed, financed, and managed by the federal 
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government and (2) a decentralized approach: a program requiring ports 
and port facilities to design, finance, and manage programs to issue 
identification cards. 9 According to TSA documents, each approach is to 
meet federally established standards for technical performance and 
interoperability 10 across different transportation modes (such as air, 
surface, or rail). 

Appropriations committee conference reports, for fiscal years 2003 and 
2004, directed up to $85 million 11 of appropriated funds for the 
development and testing of a maritime worker identification card system 
prototype. With respect to fiscal year 2005 appropriations, $15 million was 
directed for the card program. 12 The fiscal year 2005 funding was 
decreased from the $65 million as proposed by the House and the 
$53 million as proposed by the Senate because of delays in prototyping 
and evaluating the card system, according to the conference committee 
report. 13 

Several forms of guidance and established best practices apply to the 
acquisition and management of a major information technology system 
such as the maritime worker identification card program. 14 For major 
information technology investments, DHS provided capital planning and 



A senior TSA official said that under the decentralized approach, TSA would not issue the 
card but would issue a regulation that would require local entities to issue the card. 

10 Interoperability means that the system will allow transportation workers to use the same 
card and associated background checks at multiple transportation facilities. 

"Specifically, the Conferees directed $50 million to the transportation worker identification 
card for fiscal year 2004 and $35 million jointly to the credentialing program and another 
program — the aviation registered traveler program — for fiscal year 2003. See, H.R. Conf. 
Rept. No. 108-280, at 37-38 (2003) and H.R. Conf. Rept. No. 108-10, at 1235-1236 (2003). 

12 H.R. Conf. Rept. No. 108-774, at 53 (2004). The Conferees specified that of the total 
funding, $5 million is a direct appropriation that is to be used to develop and install 
necessary hardware and software at those sites producing and personalizing the 
transportation worker identification credentials. The Conferees further specified that the 
additional $10 million appropriation would be offset throughout the fiscal year from 
application fees. 

11 Of the total amounts provided in both the House and Senate Committee on 
Appropriations reports, each committee report specified that $50 million was to be offset 
throughout the fiscal year from fee collections. See, H.R. Rept. No. 108-541, at 48 (2004); S. 
Rept. No. 108-280, at 38 (2004). 

14 DHS classified the maritime worker identification card as a major information technology 
investment under DHS guidelines. 
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investment control guidance as early as May 2003 that established four 
levels of investments, the top three of which are subject to review by 
department-level boards, including the Investment Review Board (IRB) 
and the Enterprise Architecture Board. The guidance also laid out a 
process for selecting, controlling, and managing investments. For example, 
DHS guidance suggests that as part of the control process, the agency 
should consider alternative means of achieving program objectives, such 
as different methods of providing services and different degrees of federal 
involvement. The guidance recommends that an alternatives analysis — a 
comparison of various approaches that demonstrates one approach is 
more cost-effective than others — should be conducted and a preferred 
alternative selected on the basis of that analysis. For projects like the 
maritime worker identification card program, whose costs and benefits 
extend 3 or more years, OMB also instructs federal agencies, including 
TSA, to complete an alternative analysis as well as a cost-benefit analysis. 15 
This analysis is to include intangible and tangible benefits and costs and 
willingness to pay for those benefits. In addition to DHS and OMB 
guidance, established industry best practices identify project management 
and planning best practices for major information technology system 
acquisition, including the development of a comprehensive plan to guide 
the project as detailed later in this report. 16 



°Office of Management and Budget, Guidelines and Discount Rates for Benefit-Cost 
Analysis of Federal Programs, Circular A-94, revised October 29, 1992. OMB requires both 
a cost-benefit analysis and an alternatives analysis to be completed but does not specify at 
what point in the project this work is to be done. However, DHS guidance and best 
practices for program management recognized by DHS suggest that programs complete an 
alternatives analysis in an early planning stage and then test a prototype of the preferred 
alternative. 

16 Carnegie Mellon's Software Engineering Institute, a federally-funded research and 
development center operated by Carnegie Mellon University and sponsored by the U.S. 
Department of Defense, created models such as Capability Maturity Model® Integration 
(CMMI) to guide information technology projects through best practices of project 
planning and project management. The CMMI sets out specific project planning activities 
that should take place for a project to best fulfill its mission. 
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Three Main Factors 
Caused TSA to Miss 
Its Initial Target Date 
for Issuing Worker 
Identification Cards 



Three main factors, all of which resulted in delays for testing the prototype 
card system, caused the agency to miss its initial August 2004 target date 
for issuing maritime worker identification cards. First, program officials 
said that although they received permission from TSA and DHS 
information technology officials to test a card system prototype, TSA 
officials had difficulty obtaining a response from DHS policy officials, 
contributing to the schedule slippage. Program officials said that although 
DHS officials reviewed the proposed card system during late 2003, senior 
officials provided no formal direction to program staff. Senior DHS 
officials said that while they were consistently briefed throughout the 
development of the worker identification card system, they did not 
provide formal direction regarding the prototype test because other 
important statutory and security requirements required their attention. For 
example, the creation and consolidation of DHS and the planning and 
execution of measures to close security gaps in the international aviation 
arena led to competition for executive-level attention and agency 
resources. DHS policy officials subsequently approved the test of a card 
system prototype. 



Second, while providing this approval, DHS officials also directed TSA, as 
part of the prototype test, to conduct a cost-benefit analysis and to 
evaluate the feasibility of other program alternatives for providing a card. 
TSA had completed these analyses earlier in the project, but DHS officials 
said they did not provide sufficiently detailed information on the costs and 
benefits of the various program alternatives. TSA officials said that 
because of the urgency to establish an identification card program after 
the terrorist attacks of September 11, 2001, the earlier cost-benefit and 
alternatives analyses were not completely documented as typically 
required by OMB regulations and DHS guidance. Working with DHS and 
OMB officials to identify additional information needed for a cost-benefit 
analysis and alternatives analysis required additional time, further delaying 
the prototype test. 



Third, TSA officials said that before testing the card system prototype, in 
response to direction from congressional committees, TSA conducted 
additional tests of various card technologies. Officials assessed the 
capabilities of various card technologies, such as their reliability, to 
determine which technology was most appropriate for controlling access 
in seaports. This technology assessment required 7 months to complete, 
more time than anticipated, delaying the prototype test. This analysis is 
typical of good program management and planning and, while it may have 
delayed the original schedule, the purpose of such assessments is to 
prevent delays in the future. 
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DHS has not determined when it may begin issuing cards under any of the 
three proposed program alternatives — the federal, decentralized, or TWIC 
programs. Because of the delays in the program, some port facilities have 
made temporary security improvements while waiting for TSA's maritime 
worker identification card system. 17 Others, recognizing an immediate 
need to enhance access control systems, are proceeding with plans for 
local or regional identification cards that may require additional 
investment in order to make them compatible with TSA's system. For 
example, the state of Georgia is implementing a state-based maritime 
worker identification card, and ports along the eastern seaboard are 
pursuing plans for a regional identification card. 



TSA officials indicated that in the near future, as they move forward with 
developing and operating a maritime worker identification card program, 
they face a number of challenges, including resolving issues with 
stakeholders, such as how to share costs of the program, determining the 
fee for the maritime worker identification card, obtaining funding for the 
next phase of the program. Further, in the coming months, regardless of 
which approach the DHS chooses — the federal, decentralized, or TWIC 
approach — TSA will also face challenges completing key program policies, 
regulatory processes, and other work as indicated in table 1. 



Using Established 
Planning and 
Management 
Practices Could Help 
TSA Address 
Challenges and Better 
Manage Risk 



According to a senior DHS official, the timeframe for issuing cards depends on which 
approach DHS selects. DHS policy officials are expected to make this decision during 
TSA's test of a TWIC prototype, which began in November 2004. 
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Table 1 : Policy Issues to Be Completed and Regulatory Processes to Be Finalized 



Work to be accomplished 


Explanation 


Estimated schedule 


Eligibility requirements 


A basic program requirement has not been 
determined. While MTSA contains some general 
provisions relating to eligibility, DHS has not 
established which felony convictions should disqualify 
maritime workers as posing a terrorism risk. DHS has 
said it will likely base the maritime worker eligibility 
requirements on those used to screen hazardous 
material truck drivers but has not determined whether 
all workers will be required to meet the same 
requirements for a credential. 


Unknown 


Policies for adjudicating card applications 
and appeal and waiver requests from 
workers denied a card 


Program policies, procedures, and processes for 
adjudicating card applications and appeal and waiver 
requests have not been developed. While MTSA 
contains general provisions relating to adjudicating 
applications, neither TSA nor DHS has established an 
appeal and waiver process for workers denied a card. 


Unknown 


Card issuance 


Whether TSA will field a credential through a TWIC During or at conclusion of 
program or establish a decentralized program requiring prototype 
other entities to issue the card has not been decided. 


Cost sharing 


The extent to which the federal government or local 
public and private stakeholders will bear costs for a 
maritime worker identification card program has not 
been decided. 


During or at conclusion of 
prototype 


Scope of card 


TSA officials have not decided whether the biometric 
identification card will be implemented intermodally, 
that is, in transportation sectors other than seaports, 
and what issues related to intermodal implementation 
would affect implementation in seaports. 


Unknown 


Regulatory processes 


Several regulations, including a final rule implementing 
the MTSA card requirement and a regulatory impact 
assessment, are yet to be completed. Estimated best- 
case scenario for time needed to a final rule is 9 to 12 
months, according to TSA officials. Time needed to 
complete other regulatory processes is unknown. 


Unknown 


Source: GAO analysis of TSA documents. 



While TSA officials acknowledged the importance of completing key 
program policies, for example, establishing the eligibility requirements a 
worker must meet before receiving a card and processes for adjudicating 
appeals and requests for waivers from workers denied a card, officials also 
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said that this work had not yet been completed. 18 A senior TSA official and 
DHS officials said they plan to base these policies and regulations for the 
maritime worker identification card on those TSA is currently completing 
for the hazardous materials endorsement for commercial truck drivers. 19 
According to a senior TSA official who was in charge of the card program, 
TSA placed a higher priority on completing regulations for the hazardous 
materials endorsement than completing those for the maritime worker 
identification card. 

TSA has other work to complete in addition to these policies and 
regulations. TSA officials said OMB recently directed them and DHS 
officials to develop the TWIC program card in a way that allows its 
processes and procedures to also be used for other DHS credentialing 
programs. To develop such a system, DHS expects TSA to standardize, to 
some degree, eligibility requirements for the maritime worker 
identification card with those for surface and aviation workers, a task that 
will be challenging, according to officials. 20 In the near future, TSA will 
need to produce other work, for instance, it has initiated but not yet 



18 While MTSA contains some general provisions related to eligibility, it requires DHS to 
establish which felony convictions indicate that a maritime worker could pose a terrorism 
security risk and should therefore be disqualified from receiving a card. MTSA also requires 
DHS officials to develop processes for workers to appeal the denial of a card and to request 
a waiver of the eligibility requirements allowing them to receive a card if disqualified due to 
their criminal record. 

19 TSA plans to harmonize the eligibility requirements for the maritime worker identification 
card with credentialing requirements for surface and aviation workers. 

20 DHS officials expect TSA to make recommendations that establish eligibility 
requirements for maritime workers and harmonize them, to the extent possible, with those 
used to screen surface and aviation transportation workers. Certain workers in the aviation 
industry, the maritime industry, and track drivers seeking a license to transport hazardous 
materials are subject to statutorily required background and criminal history record 
checks. With respect to the results of criminal history record checks in the aviation 
context, disqualifying criminal offenses are set out in statute. Neither the USA PATRIOT 
Act provisions relating to records checks of transporters of hazardous materials nor the 
MTSA provisions relating to records checks of maritime workers specify the types of 
criminal offenses to be considered as grounds for disqualification. With respect to workers 
in the maritime industry, MTSA further requires the issuance of a biometric security card 
for maritime workers. 



Page 12 



GAO-05-106 Port Security 



finalized cost estimates for the card program 21 and a cost-benefit analysis, 
which is a necessary part of a regulatory impact analysis required by OMB 
regulations. 

Our analysis, however, indicates that TSA faces another significant 
challenge besides the ones it has identified. This challenge is that TSA is 
attempting to proceed with the program without following certain 
industry-established best practices for project planning and management. 
Two key components of these practices are missing. The first is a 
comprehensive plan that identifies work to be completed, milestones for 
completing this work, and project budgets for the project's remaining life. 
The second is detailed plans for specific and important components of the 
project — particularly mitigating risks and assessing alternative 
approaches — that would support the overall project plan. Failure to 
develop these plans holds significant potential to adversely affect the card 
program, putting it at higher risk of cost overruns, missed deadlines, and 
underperformance. 



TSA has estimated the total life-cycle program costs to the federal government of a TWIC 
approach to be about $1 billion. This estimate spans 10 years, fiscal years 2005 - 2014, and 
does not include all program costs, such as costs to port facilities, costs of background 
checks, and costs to adjudicate applications for a biometric identification card, appeal the 
decision to deny a worker a biometric transportation card, and waiver requests should a 
maritime worker not meet the eligibility requirements for a biometric identification card 
(e.g., if he or she was convicted of a serious felony making him or her ineligible for the 
card). TSA estimates the cost to maintain the TWIC program would be $116.2 million per 
year. TSA program officials said that the costs to the government would be recovered 
through a statutorily authorized fee collection program, but the agency has not established 
the fee amount yet. 
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Over the years, we have analyzed information technology systems across a 
broad range of federal programs and agencies, and these analyses have 
repeatedly shown that without adequate planning, the risks increase for 
cost overruns, schedule slippages, and systems that are not effective or 
usable. 22 According to industry best practices for managing information 
technology projects like the maritime worker identification card, program 
managers should develop a comprehensive project plan that governs and 
defines all aspects of the project, tying them together in a logical manner. 23 
A documented comprehensive project plan is necessary to achieve the 
mutual understanding, commitment, and performance of individuals, 
groups, and organizations that must execute or support the plans. A 
comprehensive project plan identifies work to be completed, milestones 
for completing this work, and project budgets as well as identifying other 
specific, detailed plans that are to be completed to support the 
comprehensive project plan. 

The comprehensive plan, in turn, needs to be supplemented by specific, 
detailed plans that support the plan where necessary. Such plans might be 
needed to address such matters as the program's budget and schedule, 
data to be analyzed, risk management and mitigation, staffing. For 
example, a risk mitigation plan would be important in situations where 
potential problems exist. One purpose of risk management is to identify 
potential problems before they occur; a risk mitigation plan specifies risk 
mitigation strategies and when they should be invoked to mitigate adverse 
outcomes. Effective risk management includes early and aggressive 
identification of risks because it is typically easier, less costly, and less 
disruptive to make changes and correct work efforts during the earlier 
phases of the project. In addition, plans for activities such as cost-benefit 



" See GAO, Maritime Security: Better Planning Needed to Help Ensure and Effective Port 
Security Assess Program, GAO-04-1062 (Washington, D.C.: Sept. 29, 2004); Land 
Management Systems: Progress and Risks in Developing BLM's Land and Mineral 
Record System, GAO/AIMD-95-180 (Washington, D.C.: Aug. 31, 1995); Land Management 
Systems: BLM Faces Risks in Completing the Automated Land and Mineral Record 
System, GAO/AIMD-97-42 (Washington, D.C.: Mar. 19, 1997); Land Management Systems: 
Actions Needed in Completing the Automated Land and Mineral Record System 
Development, GAO/AIMD-98-107 (Washington, D.C.: May 15, 1998); and Land Management 
Systems: Major Software Development Does Not Meet BLM's Business Needs, 
GAO/AIMD-99-135 (Washington, D.C.: Apr. 30, 1999) 

23 Carnegie Mellon's Software Engineering Institute, a federally funded research and 
development center operated by Carnegie Mellon University and sponsored by the U.S. 
Department of Defense, created models such as Capability Maturity Model® Integration to 
guide information technology projects through best practices of project planning and 
project management. 



Best Practices for Planning 
and Key Management 
Practices Are Important 
for Information 
Technology Programs 
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and alternatives analyses should be developed to help facilitate data 
collection and analysis. These types of plans typically describe, among 
other things, the data to be collected, the source of these data, and how 
the data will be analyzed. Such plans are important to guide needed data 
analysis as well as prevent unnecessary data collection, which can be 
costly. For this program, both risk mitigation and data analysis are key, 
because the program runs significant risks with regard to ensuring 
cooperation of stakeholders, and because TSA still faces considerable 
analytical work in deciding which approach to adopt. 



Lack of a Comprehensive 
Project Plan Could Limit 
TSA's Ability to Complete 
Future Work 



According to TSA officials, the agency lacks an approved, comprehensive 
project plan to guide the remaining phases of the project, which include 
the testing of a maritime worker identification card system prototype and 
issuance of the cards. While it has initiated some project planning, 
according to officials, the agency has not completed a comprehensive 
project plan, which is to identify work to be completed, milestones for 
completing this work, and project budgets as well as identifying other 
specific, detailed plans that are to be completed. Officials said that with 
contractor support they intended to develop a plan to manage the 
prototype test. However, officials did not intend to develop a plan for the 
remainder of the project until key policy decisions had been made, such as 
what type of card program will be selected to issue the cards. 24 Once key 
policies are determined, TSA may move forward with a comprehensive 
plan. As a consequence of not having such a plan in place, officials have 
not documented work to be completed, milestones for completing it, or 
accountability for ensuring that the work is done. Without a 
comprehensive project plan and agreement to follow the plan from the 
appropriate DHS and TSA officials, TSA program staff may have difficulty 
managing future work, putting the program at higher risk of additional 
delays and cost overruns. Officials did not provide a timeframe for 
completing such a project plan. 



TSA officials said that they cannot complete an implementation plan until DHS decides 
which type of program — the federal, decentralized, or TWIC — will be implemented. Of the 
various strategies for rolling out the card program, officials said TSA must determine which 
one is the best, for instance, a regional strategy where cards are issued to workers in all 
transportation sectors in one geographic region or a threat-based strategy, where cards are 
first issued to workers in maritime ports considered at highest risk. 
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Lack of Specific Plan for 
Mitigating Risks Could 
Affect TSA's Ability to 
Partner with Stakeholders 



According to TSA planning documents and discussions with officials, TSA 
lacks a risk management plan that specifies strategies for mitigating 
known risks which could limit TSA's ability to manage these risks. For 
instance, TSA documents identified failure to sustain the support of 
external stakeholders, such as labor unions for port workers, as a program 
risk and indicated a mitigation strategy was needed to address this risk. 
But, TSA has not developed such a strategy to address this specific risk. 
TSA documents also indicated that involving stakeholders in decision 
making could help mitigate program risks associated with defining the 
eligibility requirements for the card. However, TSA has not planned for 
stakeholder involvement in decision-making. 

Several stakeholders at ports and port facilities told us that while TSA 
solicited their input on some issues, TSA did not respond to their input or 
involve them in making decisions regarding eligibility requirements for the 
card. 25 In particular, some stakeholders said they had not been included in 
discussions about which felony convictions should disqualify a worker 
from receiving a card, even though they had expected and requested that 
DHS and TSA involve them in these decisions. One port security director 
said TSA promised the port a "large role" in determining the eligibility 
requirements which has not materialized, and others said that in the 
absence of TSA defining the eligibility requirements for the card, they 
recently drafted and sent proposed eligibility requirements to TSA. TSA 
officials said they have an extensive outreach program to inform external 
stakeholders about the program, for instance, by frequently attending 
industry conferences and maritime association meetings. 

Obtaining stakeholder involvement is important because achieving 
program goals hinges on the federal government's ability to form effective 
partnerships among many public and private stakeholders. If such 
partnerships are not in place — and equally important, if they do not work 
effectively — TSA may not be able to test and deliver a program that 
performs as expected. For example, TSA currently relies on facilities and 
workers to voluntarily participate in tests of the prototype card system. 
Without this and other support provided by stakeholders, the prototype 
card system could not be tested as planned. Planning for stakeholder 



Of the facilities testing TSA's prototype, we visited ports and facilities in the Delaware 
River Region, including Wilmington Port Authority, the Philadelphia Maritime Exchange, 
and the South Jersey Port. We also visited ports and facilities on the west coast, including 
those in the Port of Seattle, Port of Los Angeles, and Port of Long Beach as well as ports 
and facilities in Florida, including Port Everglades and the Port of Jacksonville. 
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involvement is also important because in the future other groups or 
organizations, for instance, other federal agencies or states, may be 
charged with developing biometric identification card programs and 
emerge as important external stakeholders for the maritime worker 
identification card program. 26 



Lack of Specific Plans for 
Cost-Benefit and 
Alternatives Analyses 
Could Create Further 
Delays 



According to best practices, in order to ensure that the appropriate data 
are collected to support analyses on which program decisions are made, 
managers should develop a plan that describes data to be collected, the 
source of these data, and how the data will be analyzed. During the test of 
the prototype card system, officials said they are to collect data on the 
feasibility of the federal and decentralized approaches in order to conduct 
an alternatives analysis — a comparison of the three possible approaches 
that demonstrates one approach is more cost-effective than the others. 
TSA officials acknowledge they have not yet completed a plan; however, 
they said they intend to do so with contractor support. On the basis of 
interviews with a number of officials and review of documents, we 
determined TSA has not identified who would be responsible for 
collecting the data; the sources for the data, and how it will be analyzed. 
These details are needed to ensure production of a good result. 
Completing the cost-benefit and alternatives analyses is important because 
not only do OMB regulations and DHS guidance instruct agencies to 
complete them, but DHS officials said the alternatives analysis would 
guide their decision regarding which approach is the most cost-effective 
way to provide the card. Without a plan to guide this activity, TSA may not 
perform the necessary analysis to inform sound decision making, possibly 
causing further delays. 



Conclusions With the passage of MTSA, Congress established a framework for 

! lJ ~" homeland security that relies on a multilayered defense strategy to 

enhance port security. Improving access control by providing ports a 
maritime worker identification card is an important part of this strategy. 
Each delay in TSA's program to develop the card postpones enhancements 



As a result of the recommendations made in the report of the National Commission on 
Terrorist Attacks upon the United States (the 9/11 Commission), Congress has considered 
legislative proposals related to biometric identification cards. While it is too soon tell what 
effect, if any, legislative proposals may have on the maritime worker identification card 
program, such proposals could create new and important stakeholders for the card, have 
the potential to affect the design and implementation of TSA's card program, or make the 
TSA card unnecessary and duplicative. 
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to port security and complicates port stakeholders' efforts to make wise 
investment decisions regarding security infrastructure. 

Despite delays and the difficulties of a major governmentwide 
reorganization, DHS and TSA have made some progress in developing a 
maritime worker identification card. Nevertheless, without developing a 
comprehensive project plan and its component parts — an established 
industry best practice for project planning and management — TSA is 
placing the program's schedule and performance at higher risk. More 
delays could occur, for example, unless DHS and TSA agree on a 
comprehensive project plan to guide the remainder of the project, identify 
work that TSA and DHS officials must complete, and set deadlines for 
completing it. Without adequate risk mitigation plans, TSA may not be able 
to resolve problems that could adversely affect the card program 
objectives, such as insufficient stakeholder support to successfully 
develop, test, and implement the card program. Further, without a plan to 
guide the cost-benefit and alternatives analyses, TSA increases the risk 
that it may fail to sufficiently analyze the feasibility of various approaches 
to issue the card, an analysis needed by DHS policy officials to make 
informed decisions about the program, putting the program at risk for 
further delays. 



RGCOmmGndcltionS for ^° ensure ^ na ^ TSA meets the challenges it is facing in developing and 

operating its maritime worker identification card program, we are 

Executive Action recommending that the Secretary of Homeland Security direct the TSA 

Administrator to employ industry best practices for project planning and 
management, by taking the following two actions: 

• Develop a comprehensive project plan for managing the remaining life of 
the project. 

• Develop specific, detailed plans for risk mitigation and cost-benefit and 
alternatives analyses. 



We provided a draft of this report to DHS and TSA for their review and 
comment. DHS and TSA generally concurred with the findings and 
recommendations that we made in our report and provided technical 
comments that we incorporated where appropriate. DHS and TSA also 
provided written comments on a draft of this report (see app. I). In its 
comments, DHS noted actions that it has recently taken or plans to take to 
address concerns we raised regarding outstanding regulatory and policy 
issues. 



Agency Comments 
and Our Evaluation 
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Although DHS and TSA concurred with our recommendations, in their 
comments, they contend that project plans and program management 
controls are currently in place to manage their test of the TWIC prototype. 
However, at the time of our review, the project planning documents 
identified by DHS and TSA in their comments were incomplete, lacked the 
necessary approvals from appropriate officials, or were not provided 
during our audit. Furthermore, project plans and other management 
controls have not been developed for the remaining life of the project. 



We are sending copies of this report to other interested Members of 
Congress. We are also sending copies to the Secretary of Homeland 
Security. We will make copies available to others upon request. In 
addition, the report will be available at no charge on GAO's Web site at 
http://www.gao.gov. 

If you or your staffs have any questions about this report, please contact 
me at (415) 904-2200 or at wrightsonm@gao.gov. Other major contributors 
to this report included Jonathan Bachman, Chuck Bausell, Tom Beall, 
Steve Calvo, Ellen Chu, Matt Coco, Lester Diamond, Geoffrey Hamilton, 
Rich Hung, Lori Kmetz, Anne Laffoon, Jeff Larson, David Powner, Tomas 
Ramirez, and Stan Stenerson. 




Margaret T. Wrightson 
Director, Homeland Security 
and Justice Issues 
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Appendix I: Comments from the Department 
of Homeland Security 



U.S. Department of Homeland Sccuriu 

Washington. DC 2(1528 

|pjj| Homeland 
Security 



December 1, 2004 



Ms. Margaret Wrightson 

Director, Homeland Security & Justice Issues 

U.S. Government Accountability Office 

441 G Street, NW 

Washington, DC 20548 

Dear Ms. Wrightson: 

RE: GAO-05-106, Port Security: Better Planning Needed to Develop and Operate 
Maritime Worker Identification Card Program (GAO Job Code 440265) 

Thank you for the opportunity to review the subject draft report. The Department of Homeland 
Security (DHS) appreciates the work done to identify areas for improvement in the 
Transportation Security Administration's (TSA) Transportation Worker Identification Credential 
(TWIC) program referred to in the report as the Maritime Worker Identification Card Program. 
We generally concur with the recommendations and appreciate the discussion and 
acknowledgement of challenges and progress made, and suggested action this report contains. 
However, DHS has comments on parts of the report. 

DHS would like to emphasize the dynamic and maturing organizational environment in which 
the TWIC program has operated. The creation of TSA within the Department of Transportation 
and its subsequent transfer to DHS in 2003 created challenges for TWIC officials by requiring 
the program to move forward without the benefit of long-standing and mature institutional 
frameworks. 

Regulatory Concerns 

The report highlights concerns about regulations not being completed, including a final rule 
implementing the Maritime Transportation Security Act card requirement and a regulatory 
impact assessment. TSA and the Coast Guard are beginning work on joint rulemaking for the 
implementation of the TWIC program for maritime workers. The information gained from the 
prototype phase should provide valuable input to the rulemaking process. TSA will work with 
other agencies to develop complementary rules for transportation modes other than maritime. 
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Policy Decisions 

The report also lists numerous policy decisions that must be made in order for the TW1C 
program to proceed on schedule. As part of the Capital Planning and Investment Control 
process, and as directed by the DHS Investment Review Board, TSA is working closely with 
other DHS organizational elements to identify and resolve any outstanding policy questions. 
Once the prototype is complete, TSA will analyze the results to determine how the program will 
be implemented. 

GAP Recommendations 

'To help ensure that TSA meets the challenges it is facing in developing and operating its 
maritime worker identification card program, we are recommending that the Secretary of 
Homeland Security direct the TSA Administrator to employ industry best practices for project 
planning and management, by taking the following two actions: 

• Develop a comprehensive project plan for managing the remaining life of the project; 
and 

• Develop specific, detailed plans for risk mitigation and cost-benefit and alternatives 
analyses." 

Responses to GAP Recommendations 

Project Management 

DHS concurs with the GAO recommendation to develop a comprehensive plan for managing the 
remaining components of the TWIC project. Significant program management controls are 
currently in place. These controls are assisting TSA in managing Phase III - Prototype and 
include: 

• A detailed milestone schedule that tracks all phases of the TWIC system development 
lifecycle, key milestones, deliverables, and associated tasking; 

• Daily and weekly project team meetings that consist of in-depth reviews of the project 
schedule baseline, current issues requiring management attention and action, relevant 
project-phase deliverables, documentation, stakeholder issues, and program 
communications; 

• A detailed Program Management Control Plan; 

• Risk Assessment and Mitigation Planning; 

• Configuration Management and Change Control; 

• A project Quality Assurance Plan; and 

• A detailed and iterative cost model to assist in developing budget projections during the 
lifecycle of the project. 

The recent successful demonstration of the TWIC Prototype initial operating capability is 
testimony to the efficacy of the program controls in place. The seven-month pilot will involve 
up to 200,000 workers in six states at 34 sites. Pn November 17, 18, and 19, 2004, workers 
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received their credentials at the Port of Los Angeles, the Long Beach Container Terminal in 
California, at Port Canaveral and the Port of Pensacola in Florida, and at the Maritime Exchange 
in Philadelphia. In each instance, the enrollment, background checks, credential production, 
authorization, and issuance processes and mechanisms operated virtually problem-free. 

Risk Mitigation 

DHS agrees that a risk mitigation plan is a vital tool to support program success. To that end, 
TSA is developing a "Risk Mitigation Plan for TWIC". The plan will describe the specific steps 
program officials will take to identify, analyze, plan, track and control risks. The plan will 
specify the frequency of such activities and the expected outputs and actions the program 
officials will take to manage and mitigate risks. 

In developing the plan, the TWIC Program Team has conducted numerous sessions to identify, 
analyze, and plan risk mitigation strategies for the program. When the Risk Mitigation Plan is 
fully implemented, the program will satisfy the risk mitigation recommendation specified in the 
GAO report. 

Cost Benefit Analysis and Alternatives Analysis 

DHS agrees that a cost-benefit analysis and alternatives analysis needs to be performed. To that 
end, TSA is actively working to complete these analyses. 

As stated in the Alternatives Development Document, the TSA has analyzed a number of 
implementation options and eliminated those options that were deemed to be non-viable due to 
cost, schedule, or inability to meet mission goals or performance objectives. TSA will analyze 
the remaining alternatives and methods of implementation, applying reasonable assumptions, 
constraints and conditions, deriving cost estimates for the alternatives based on these factors. 
TSA will then analyze the potential benefits for each alternative and compare them to the 
projected costs. The cost benefit analysis focuses on comparing the potential costs and benefits 
of Federal versus decentralized oversight and implementation. 



Sincerely, 

?, Anna F. Dixon 
Director 

Departmental GAO/OIG Liaison Office 



(440265) 
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GAO's Mission ^ ne Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 
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